Hi James, Performance will be hurt if you disable cache. The cache can be cleared on multiple levels [1] to make sure permission changes are picked up.
[1] https://shiro.apache.org/static/current/apidocs/org/apache/shiro/realm/AuthorizingRealm.html#clearCachedAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection) On Thu, Jun 26, 2014 at 11:46 PM, james agada <[email protected]> wrote: > I think I got it fixed. There were two problems > 1. If I used a cache manager, then it seems shiro will not reload the user > roles and permissions after the first load. So any changes will require a > restart of the app. My solution is not to use cache. How does this affect > performance when we have a couple of hundred users? > 2. I got the permission > > >> On Tue, Nov 12, 2013 at 10:26 AM, David Tildesley <[email protected]> >> wrote: >> > I know but that should be only when I use that permission. >> >> >> Assumptions you can't afford - make those suggested corrections (all of >> them) and try again. >> >> >I also define entities for user, permission and role in my isis app. >> >These entities map to the tables used by shiro. >> >Could there be conflict between shiro using the tables via jdbc and >> >Isis using the entities? >> >> >> Probably not - unless you are getting errors that indicate an issue. You >> could temporarily remove the ISIS entities to know for sure. >> >> >> >> >> On Tuesday, 12 November 2013 6:53 PM, james agada <[email protected]> >> wrote: >> >> I also define entities for user, permission and role in my isis app. >> These entities map to the tables used by shiro. >> Could there be conflict between shiro using the tables via jdbc and >> Isis using the entities? >> >> Sent from my iPhone >> >> >> > On Nov 12, 2013, at 12:59 AM, David Tildesley <[email protected]> wrote: >> > >> > >> > >> > Firstly, I don't think this value is valid: >> > >> > "*:Inventory:*:r,w" >> > >> > It needs to be: >> > "*:Inventory:*:*" >> > >> > >> > I don't what Inventory does but generally you only need to specify the >> > implementation class in the permission mapping. >> > >> > David. >> > >> > >> > >> > >> > On Monday, 11 November 2013 11:59 PM, james agada <[email protected]> >> > wrote: >> > >> > The other tables. >> > 1. Table - User >> > >> > USER_ID,DESCRIPTION,NAME,OWNEDBY,PARTY_PARTY_ID_OID,PASSWORD,VERSION >> > 1,"James Agada",james,sven,2,ixzdore,4 >> > 2,"Anthonia Eze",Anthonia,sven,3,ANTHONIA,2 >> > 3,"sven from isis",sven,sven,2,pass,2 >> > 4,"chimaje agada new",chimaje,james,1,chimaje,3 >> > >> > 2. Table -Userroles >> > >> > USERID,ROLEID,IDX >> > 1,1,0 >> > 2,2,0 >> > 3,3,0 >> > 4,3,0 >> > >> > 3. Table - Role >> > ROLE_ID,DESCRIPTION,NAME,OWNEDBY,VERSION >> > 1,"Site Administrator",SITEADMIN,sven,10 >> > 2,"Normal Site User",SITEUSER,sven,3 >> > 3,"Root Admin Role",admin_role,sven,2 >> > >> > >> > 4. Table - RolePermissions >> > ROLEID,PERMISSIONID,IDX >> > 1,5,0 >> > 2,2,0 >> > 2,4,1 >> > 3,3,0 >> > >> > >> > >> > >> > >> > >> > On Mon, Nov 11, 2013 at 5:17 AM, David Tildesley >> > <[email protected]>wrote: >> > >> >> I suggest you remove the [users] and [roles] sections from the ini file as >> >> they are not needed for your purpose and from memory there is some >> >> side-effect from leaving them in place when not using the iniRealm. It >> >> would be useful to see the other tables as well. >> >> >> >> David. >> >> >> >> >> >> >> >> >> >> On Monday, 11 November 2013 3:16 AM, james agada <[email protected]> >> >> wrote: >> >> >> >> I have struggled with this for some time and i still cannot get the >> >> behaviour right. Now, it is only a permission of * that works. Anyother >> >> permission and the user cannot see the menu or dashboard. I also have to >> >> shut down and restart before any permission changes or user definitions >> >> take effect. >> >> >> >> Here is the shiro.ini >> >> >> >> # >> >> >> >> # Licensed to the Apache Software Foundation (ASF) under one >> >> >> >> # or more contributor license agreements. See the NOTICE file >> >> >> >> # distributed with this work for additional information >> >> >> >> # regarding copyright ownership. The ASF licenses this file >> >> >> >> # to you under the Apache License, Version 2.0 (the >> >> >> >> # "License"); you may not use this file except in compliance >> >> >> >> # with the License. You may obtain a copy of the License at >> >> >> >> # >> >> >> >> # http://www.apache.org/licenses/LICENSE-2.0 >> >> >> >> # >> >> >> >> # Unless required by applicable law or agreed to in writing, >> >> >> >> # software distributed under the License is distributed on an >> >> >> >> # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY >> >> >> >> # KIND, either express or implied. See the License for the >> >> >> >> # specific language governing permissions and limitations >> >> >> >> # under the License. >> >> >> >> # >> >> >> >> >> >> [main] >> >> >> >> ps = org.apache.shiro.authc.credential.DefaultPasswordService >> >> >> >> pm = org.apache.shiro.authc.credential.PasswordMatcher >> >> >> >> pm.passwordService = $ps >> >> >> >> >> >> aa = org.apache.shiro.authc.credential.AllowAllCredentialsMatcher >> >> >> >> sm = org.apache.shiro.authc.credential.SimpleCredentialsMatcher >> >> >> >> >> >> ds = com.jolbox.bonecp.BoneCPDataSource >> >> >> >> ds.driverClass = com.mysql.jdbc.Driver >> >> >> >> ds.jdbcUrl = jdbc:mysql://localhost:3306/myticket >> >> >> >> ds.username = root >> >> >> >> #ds.password = . >> >> >> >> jdbcRealm.dataSource = $ds >> >> >> >> >> >> jdbcRealm = org.apache.shiro.realm.jdbc.JdbcRealm >> >> >> >> jdbcRealm.permissionsLookupEnabled = true >> >> >> >> jdbcRealm.credentialsMatcher = $sm >> >> >> >> builtInCacheManager = org.apache.shiro.cache.MemoryConstrainedCacheManager >> >> >> >> >> >> >> >> jdbcRealm.dataSource = $ds >> >> >> >> >> >> jdbcRealm.authenticationQuery = SELECT password FROM user WHERE name = ? >> >> >> >> jdbcRealm.userRolesQuery = SELECT role.name AS role_name FROM >> >> user,userroles, >> >> role WHERE user.user_id = userroles.userid AND userroles.roleid = >> >> role.role_id AND user.name = ? >> >> >> >> jdbcRealm.permissionsQuery = SELECT permission.permission AS roleper FROM >> >> role, permission, rolepermissions WHERE >> >> rolepermissions.roleid=role.role_id >> >> AND rolepermissions.permissionid = permission.permission_id AND role.name= >> >> ? >> >> >> >> securityManager.realms = $jdbcRealm >> >> >> >> securityManager.cacheManager = $builtInCacheManager >> >> >> >> # to use .ini file >> >> >> >> #securityManager.realms = $iniRealm >> >> >> >> >> >> >> >> >> >> # >> >> >> >> ----------------------------------------------------------------------------- >> >> >> >> # Users and their assigned roles >> >> >> >> # >> >> >> >> # Each line conforms to the format defined in the >> >> >> >> # org.apache.shiro.realm.text.TextConfigurationRealm#setUserDefinitions >> >> JavaDoc >> >> >> >> # >> >> >> >> ----------------------------------------------------------------------------- >> >> >> >> >> >> [users] >> >> >> >> # user = password, role1, role2, role3, ... >> >> >> >> >> >> >> >> sven = pass, admin_role >> >> >> >> dick = pass, user_role, self-install_role >> >> >> >> bob = pass, user_role, self-install_role >> >> >> >> joe = pass, user_role, self-install_role >> >> >> >> guest = guest, user_role >> >> >> >> >> >> >> >> >> >> # >> >> >> >> ----------------------------------------------------------------------------- >> >> >> >> # Roles with assigned permissions >> >> >> >> # >> >> >> >> # Each line conforms to the format defined in the >> >> >> >> # org.apache.shiro.realm.text.TextConfigurationRealm#setRoleDefinitions >> >> JavaDoc >> >> >> >> # >> >> >> >> ----------------------------------------------------------------------------- >> >> >> >> >> >> [roles] >> >> >> >> # role = perm1, perm2, perm3, ... >> >> >> >> # perm in format: packageName:className:memberName:r,w >> >> >> >> >> >> user_role = *:ToDoItemsJdo:*:*,\ >> >> >> >> *:ToDoItem:*:* >> >> >> >> self-install_role = *:ToDoItemsFixturesService:install:* >> >> >> >> admin_role = * >> >> >> >> >> >> *** >> >> Here is the permission table >> >> PERMISSION_ID,DESCRIPTION,NAME,OWNEDBY,PERMISSION,VERSION >> >> 1,"Create Users",CreateUser,sven,*:ToDoItemsFixturesService:install:*,7 >> >> 2,"View Existing Users",ViewUsers,sven,*:User:*:r,2 >> >> 3,"Root access",ROOT,sven,*,1 >> >> 4,"Setup inventory",SetupInventory,sven,"*:Inventory:*:r,w",1 >> >> 5,todo,TODO,sven,*:Parties:*:*,3 >> >> >> >> >> >> >> >> On Fri, Oct 25, 2013 at 3:27 AM, David Tildesley <[email protected] >> >>> wrote: >> >> >> >>> Copy us the whole shiro.ini file (blank out any sensitive connection >> >> info). >> >>> >> >>> >> >>> David. >> >>> >> >>> >> >>> >> >>> ________________________________ >> >>> From: james agada <[email protected]> >> >>> To: "[email protected]" <[email protected]> >> >>> Sent: Friday, 25 October 2013 9:23 AM >> >>> Subject: Shiro with JdbcRealm >> >>> >> >>> >> >>> I have been able to setup shire to use a jdbcrealm and authenticate >> >> against >> >>> the database. However, it does not appear to use the permissions. I want >> >> to >> >>> set a role to have permissions only to run the ToDoItems fixture service >> >>> and I give the permission as so *:ToDoItemsFixturesService:install:*. >> >> But >> >>> the user with the role still gets access to everything. Is there >> >> something >> >>> I am doing wrong? >
